Application.Agent.RA_5bec3c6a99

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Application creates the following process(es):

taskkill.exe:1296
taskkill.exe:668
47222.exe:484
7841335.exe:1448
tasklist.exe:1128
tasklist.exe:508
tasklist.exe:1188
tasklist.exe:560
tasklist.exe:528
tasklist.exe:888
tasklist.exe:456
tasklist.exe:1768
tasklist.exe:500
tasklist.exe:476
tasklist.exe:1108
tasklist.exe:1496
tasklist.exe:1036
tasklist.exe:1928
tasklist.exe:1756
tasklist.exe:504
tasklist.exe:256
tasklist.exe:492
tasklist.exe:1312
%original file name%.exe:2024
beckinsale.exe:308
find.exe:1712
find.exe:996
find.exe:1084
find.exe:752
find.exe:292
find.exe:452
find.exe:1048
find.exe:212
find.exe:656
find.exe:1744
find.exe:592
find.exe:352
find.exe:544
find.exe:1008
find.exe:252
find.exe:648
find.exe:1760
find.exe:256
find.exe:812
find.exe:1764

The Application injects its code into the following process(es):

scavenges.exe:700

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process scavenges.exe:700 makes changes in the file system.

The Application creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\crossdomain[2].xml (82 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\CAOTE15Q.gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\syncnoad[1].xml (617 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\CAQNWTQV.xml (756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\CAQ3WXYV.xml (722 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\CAFJ4KGE.xml (848 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\bgg[1].png (198 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sneezespoliticizing[2].txt (346 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\CAMJM7AF.xml (811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\syncnoad[2].xml (634 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\CAUFUD56.xml (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\CA0XSNW5.xml (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\syncnoad[2].xml (705 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\syncnoad[1].xml (693 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\syncnoad[4].xml (687 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\1[1].gif (49 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (1082 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\player1[1].swf (11393 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (15228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\itd[1].htm (1118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\CALVL4K4.xml (771 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[1].txt (556 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\CAU4KCGG.xml (760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\crossdomain[3].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\syncnoad[3].xml (596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\wau-widget[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\CA2FS5Y3.xml (760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\CAC1YL8R.xml (710 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (1068 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\jwplayer1[1].js (73901 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\syncnoad[6].xml (701 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\logo[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\ova-jw[1].swf (18321 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@everclips[1].txt (179 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\page-4[1].htm (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\CA52W54W.xml (807 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\CA5SNBXC.xml (714 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\page-4[1].htm (709 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\counter[2].js (1353 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\syncnoad[7].xml (592 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\everclips.net\com.jeroenwijering.sxx (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\counter[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\syncnoad[4].xml (689 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\CA2VQRYT.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\syncnoad[2].xml (605 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\logo[1].png (723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\CA4XM74P.xml (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\crossdomain[2].xml (130 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (1489 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\count[1].htm (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\noad[1].xml (73 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[2].txt (728 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#everclips.net\settings.sxx (202 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\syncnoad[5].xml (630 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@amung[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\CA8F23EV.xml (756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\player1[1].swf (8845 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\style[1].css (736 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\syncnoad[3].xml (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\syncnoad[6].xml (704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\CAVQDK5D.xml (687 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\syncnoad[4].xml (693 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\syncnoad[5].xml (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\syncnoad[1].xml (695 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\style[2].css (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\CATLWWU9.xml (726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\syncnoad[1].xml (804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\syncnoad[2].xml (708 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\analytics[1].js (353 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\syncnoad[7].xml (633 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\syncnoad[5].xml (800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\index5[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\syncnoad[7].xml (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\page-4[1].html (709 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\page-4[1].htm (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\syncnoad[4].xml (503 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\syncnoad[5].xml (691 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\CAUVWX23.xml (775 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\func[1].js (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sneezespoliticizing[1].txt (197 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\syncnoad[3].xml (652 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@everclips[2].txt (310 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\CA51ZV9K.xml (808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\syncnoad[3].xml (575 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.everclips[1].txt (297 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\syncnoad[6].xml (613 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\1[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\CA2VQRYT.gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@everclips[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040920140410\index.dat (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[1].txt (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\player1[1].swf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040920140410 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\style[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\page-4[1].html (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\counter[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sneezespoliticizing[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#everclips.net\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\everclips.net\com.jeroenwijering.sxx (0 bytes)

The process 47222.exe:484 makes changes in the file system.

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsx3.tmp (0 bytes)

The process 7841335.exe:1448 makes changes in the file system.

The Application creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsy5.tmp\SimpleFC.dll (5289 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nss4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy5.tmp\SimpleFC.dll (0 bytes)

The process %original file name%.exe:2024 makes changes in the file system.

The Application creates and/or writes to the following file(s):

%Program Files%\cultivators\beckinsale.exe (1030 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\7841335.exe (3090 bytes)
%Program Files%\hydrophobic\settings.dll (10159 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\hamad.lnk (505 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\47222.exe (1094 bytes)
%WinDir%\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
%System%\drivers\etc\hosts (123 bytes)
%WinDir%\settings.dll (10159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr2.tmp\ShellLink.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr2.tmp\AccessControl.dll (13 bytes)
%Program Files%\hydrophobic\scavenges.exe (5020 bytes)
%WinDir%\scavenges.exe (5020 bytes)
%Program Files%\hydrophobic\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr2.tmp\System.dll (11 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsr2.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr2.tmp\AccessControl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsr2.tmp\ShellLink.dll (0 bytes)

The process beckinsale.exe:308 makes changes in the file system.

The Application creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf7.tmp\ExecCmd.dll (4 bytes)

The Application deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsf7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh6.tmp (0 bytes)

Registry activity

The process taskkill.exe:1296 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 7B BE 56 BD FE 73 0F 27 14 B2 49 4F 5E 5D 7C"

The process taskkill.exe:668 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8D 31 32 2E D2 B6 7C 86 0C F0 66 4A 30 BA 92 AB"

The process scavenges.exe:700 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016092420160925]
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016092420160925]
"CachePrefix" = ":2016092420160925:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016092420160925]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016092420160925\"

"CacheOptions" = "11"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016092420160925]
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 28 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "35 E6 7A 16 4C DC FD E0 42 3F A3 24 42 71 8C 5F"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Application modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Application modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Application modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Application deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014040920140410]

The Application deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process 47222.exe:484 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4C 93 06 4D 9F 9E ED 15 0D D7 86 03 40 69 DE C0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process 7841335.exe:1448 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D 1A 99 F6 62 CE CB 3D 02 FB DF 20 B8 48 63 DA"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process tasklist.exe:1128 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB AE 38 D6 86 12 1E E5 5A 63 26 B5 B2 08 7F 9A"

The process tasklist.exe:508 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "99 93 A6 53 2C 8F EF A6 7C 2A B4 6C 76 EF 61 FF"

The process tasklist.exe:1188 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DC 0D 02 9D CB 77 66 0A A8 54 53 21 40 A8 34 F2"

The process tasklist.exe:560 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E5 76 8B 66 77 1F B4 81 F3 2F 7B B4 2F C0 86 7A"

The process tasklist.exe:528 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 34 E5 D2 A6 07 C0 9A 42 40 29 A8 87 92 FA 49"

The process tasklist.exe:888 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2E C0 62 AA 25 16 21 F8 F8 2A F1 B5 1C 90 11 C7"

The process tasklist.exe:456 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 2E 02 1B 2A E3 D7 EC 15 9C 72 90 5F 41 8A D7"

The process tasklist.exe:1768 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B A3 54 F0 53 37 0C 78 FE 92 4D 95 48 4B 38 49"

The process tasklist.exe:500 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "67 5F 7A 1F 66 14 DD 36 D3 23 F5 91 43 9A 5F A0"

The process tasklist.exe:476 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2C B4 BC 98 48 7B 3B E9 8B 70 E2 6F 5A 5A 49 9F"

The process tasklist.exe:1108 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FE 9B 92 8B CA A1 04 3E 04 98 1E 09 70 39 41 10"

The process tasklist.exe:1496 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 47 BF 0A A0 30 D3 AC DB 8B 6B 32 85 80 4F A4"

The process tasklist.exe:1036 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7A F4 C1 F8 53 2C B1 62 2E 8D D1 06 48 CD 8A 86"

The process tasklist.exe:1928 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "87 2A 31 53 3B 35 A3 92 0D 6F FC 77 04 18 83 D7"

The process tasklist.exe:1756 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D8 50 E9 4D 72 FB C0 1C 1D 71 B9 D0 A0 02 C1 04"

The process tasklist.exe:504 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 5B 83 6B A3 79 B5 1C BD F4 F0 51 9E FD 54 6B"

The process tasklist.exe:256 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 8E 65 13 60 C1 67 12 13 A1 3A A8 9E FA A8 45"

The process tasklist.exe:492 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 E9 CE 99 45 55 55 A9 84 FA AE 7A D6 C3 C2 1D"

The process tasklist.exe:1312 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F7 76 B4 36 4C 4D 1D E5 3F 44 39 F1 00 51 CA EB"

The process %original file name%.exe:2024 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "92 80 80 F0 89 03 9E 5A EE A6 07 5C E7 58 05 0E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"laplante" = "%Program Files%\hydrophobic\scavenges.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"cheapening" = "%Program Files%\hydrophobic\scavenges.exe"

"twitch" = "%Program Files%\hydrophobic\scavenges.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"embellished" = "%Program Files%\hydrophobic\scavenges.exe"

The process beckinsale.exe:308 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A2 C4 F3 04 38 40 BD DA 04 A3 9A 51 FA 12 C8 7F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"recoveries" = "%Program Files%\hydrophobic\scavenges.exe"

"beckinsale" = "%Program Files%\cultivators\beckinsale.exe"

The process find.exe:1712 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 52 DA 7F 18 BC F8 75 13 D8 3C BC 52 47 1A 35"

The process find.exe:996 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9E 59 5E 09 06 4E 05 F0 8A 51 5E 55 8E 70 CB A7"

The process find.exe:1084 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 AC C5 93 9C 54 00 B7 5A 36 69 13 8A B5 48 DE"

The process find.exe:752 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A E5 9C B2 50 0A B7 AE 24 6D 76 A1 70 4F 91 84"

The process find.exe:292 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "03 F5 DF 15 03 C5 5B DC F3 57 2B 4F 03 A9 B9 52"

The process find.exe:452 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "65 86 B5 73 F3 C7 D3 16 84 B2 DE 31 CA 06 02 37"

The process find.exe:1048 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 59 F1 12 E7 B1 8E 88 8C 3D 99 B0 FB 76 24 D9"

The process find.exe:212 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 12 B4 29 CB 23 CB B6 74 4C D3 A1 DB B3 45 5F"

The process find.exe:656 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E 74 0B 6C 02 D0 55 07 4F 82 5D C9 94 C3 28 77"

The process find.exe:1744 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B E7 01 32 D2 58 91 1A 04 83 8E 09 7B 28 21 9F"

The process find.exe:592 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6C 1D B9 7F BB 1D D5 75 69 93 8F E1 B4 4C CD F4"

The process find.exe:352 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 68 2E 9E 89 8C 71 E0 9F 96 5D 8D 21 1E FB D8"

The process find.exe:544 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B6 6A F2 54 4A 03 54 84 DB A3 D9 E5 3E 0B D8 0B"

The process find.exe:1008 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3B 98 D7 CB 70 74 25 D0 1E FB A0 BA AC AE AD 83"

The process find.exe:252 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F7 64 9B 09 40 C7 79 3D E8 B8 66 30 34 26 97 23"

The process find.exe:648 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 5D 87 19 CF 73 E9 97 7C F8 63 64 79 7C B4 4C"

The process find.exe:1760 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F9 8E 56 87 09 E6 63 61 7F 7D A2 E0 AF 20 EB 97"

The process find.exe:256 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5D 18 5A 2B F7 F0 BA C0 CC 22 FD EC 5D CE 17 42"

The process find.exe:812 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "64 4B DC EB AC 09 49 33 93 74 DD B5 D2 6F 7B AB"

The process find.exe:1764 makes changes in the system registry.

The Application creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 16 8A F7 01 A6 56 BC 0E BB 55 79 80 53 82 0D"

Dropped PE files

HOSTS file anomalies

The Application modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 857 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   taskkill.exe:1296
   taskkill.exe:668
   47222.exe:484
   7841335.exe:1448
   tasklist.exe:1128
   tasklist.exe:508
   tasklist.exe:1188
   tasklist.exe:560
   tasklist.exe:528
   tasklist.exe:888
   tasklist.exe:456
   tasklist.exe:1768
   tasklist.exe:500
   tasklist.exe:476
   tasklist.exe:1108
   tasklist.exe:1496
   tasklist.exe:1036
   tasklist.exe:1928
   tasklist.exe:1756
   tasklist.exe:504
   tasklist.exe:256
   tasklist.exe:492
   tasklist.exe:1312
   %original file name%.exe:2024
   beckinsale.exe:308
   find.exe:1712
   find.exe:996
   find.exe:1084
   find.exe:752
   find.exe:292
   find.exe:452
   find.exe:1048
   find.exe:212
   find.exe:656
   find.exe:1744
   find.exe:592
   find.exe:352
   find.exe:544
   find.exe:1008
   find.exe:252
   find.exe:648
   find.exe:1760
   find.exe:256
   find.exe:812
   find.exe:1764

2. Delete the original Application file.
   
3. Delete or disinfect the following files created/modified by the Application:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\crossdomain[2].xml (82 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\CAOTE15Q.gif (49 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\syncnoad[1].xml (617 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\CAQNWTQV.xml (756 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\CAQ3WXYV.xml (722 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\CAFJ4KGE.xml (848 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\bgg[1].png (198 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@sneezespoliticizing[2].txt (346 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\CAMJM7AF.xml (811 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\syncnoad[2].xml (634 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\CAUFUD56.xml (856 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\CA0XSNW5.xml (812 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\syncnoad[2].xml (705 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\syncnoad[1].xml (693 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\syncnoad[4].xml (687 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\1[1].gif (49 bytes)
   %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (1082 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\player1[1].swf (11393 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (15228 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\itd[1].htm (1118 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\CALVL4K4.xml (771 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[1].txt (556 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\CAU4KCGG.xml (760 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\crossdomain[3].xml (144 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\syncnoad[3].xml (596 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\wau-widget[1].png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\CA2FS5Y3.xml (760 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\CAC1YL8R.xml (710 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (1068 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\jwplayer1[1].js (73901 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\syncnoad[6].xml (701 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\logo[1].png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\crossdomain[1].xml (144 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\ova-jw[1].swf (18321 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@everclips[1].txt (179 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\page-4[1].htm (10 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\CA52W54W.xml (807 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\CA5SNBXC.xml (714 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\page-4[1].htm (709 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\counter[2].js (1353 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\syncnoad[7].xml (592 bytes)
   %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\everclips.net\com.jeroenwijering.sxx (80 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\counter[1].js (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\crossdomain[1].xml (144 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\syncnoad[4].xml (689 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\CA2VQRYT.gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\syncnoad[2].xml (605 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\logo[1].png (723 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\CA4XM74P.xml (766 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\crossdomain[2].xml (130 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (1489 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\count[1].htm (47 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\noad[1].xml (73 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[2].txt (728 bytes)
   %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#everclips.net\settings.sxx (202 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\syncnoad[5].xml (630 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@amung[1].txt (163 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\CA8F23EV.xml (756 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\player1[1].swf (8845 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\style[1].css (736 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OHYRGXIJ\syncnoad[3].xml (599 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\syncnoad[6].xml (704 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\CAVQDK5D.xml (687 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\syncnoad[4].xml (693 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\syncnoad[5].xml (762 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\syncnoad[1].xml (695 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\style[2].css (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\CATLWWU9.xml (726 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\syncnoad[1].xml (804 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\syncnoad[2].xml (708 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\analytics[1].js (353 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\syncnoad[7].xml (633 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\syncnoad[5].xml (800 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\index5[1].htm (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\syncnoad[7].xml (601 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\page-4[1].html (709 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\syncnoad[4].xml (503 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\syncnoad[5].xml (691 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\CAUVWX23.xml (775 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\func[1].js (3 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@sneezespoliticizing[1].txt (197 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\05I7KPMB\syncnoad[3].xml (652 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@everclips[2].txt (310 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\CA51ZV9K.xml (808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OX6J4PMZ\syncnoad[3].xml (575 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@www.everclips[1].txt (297 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\89AJKDYV\syncnoad[6].xml (613 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsy5.tmp\SimpleFC.dll (5289 bytes)
   %Program Files%\cultivators\beckinsale.exe (1030 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\7841335.exe (3090 bytes)
   %Program Files%\hydrophobic\settings.dll (10159 bytes)
   %Documents and Settings%\%current user%\Start Menu\Programs\Startup\hamad.lnk (505 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\47222.exe (1094 bytes)
   %WinDir%\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
   %System%\drivers\etc\hosts (123 bytes)
   %WinDir%\settings.dll (10159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr2.tmp\ShellLink.dll (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr2.tmp\AccessControl.dll (13 bytes)
   %Program Files%\hydrophobic\scavenges.exe (5020 bytes)
   %WinDir%\scavenges.exe (5020 bytes)
   %Program Files%\hydrophobic\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsr2.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsf7.tmp\ExecCmd.dll (4 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "laplante" = "%Program Files%\hydrophobic\scavenges.exe"
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "cheapening" = "%Program Files%\hydrophobic\scavenges.exe"
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "twitch" = "%Program Files%\hydrophobic\scavenges.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "embellished" = "%Program Files%\hydrophobic\scavenges.exe"
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "recoveries" = "%Program Files%\hydrophobic\scavenges.exe"
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "beckinsale" = "%Program Files%\cultivators\beckinsale.exe"

5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
   
6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 110
7bcde813c50a0b0e20e5f9f233bc3040
29de0a3a7170f7dd71267eee2449b462
ca004345bdd1cb292744ed711de04d19
2a9af6bcab5eb49d9a62a6ea72cdd286
e4e8ea421895b321bea9afa16d8a6fb5
851b5de8d1e586ba0301b1027800dea8
54c304cd37a8ae6ce5c21d5a5240d80c
f4ae937348a591e02f7ccb79f47cdc1f
c27730e88a7e5003ff846e8f0e578968
023529d5b4f5db6fc3e123bf47ac15d6
8e38be8c510a94c0a96ee39bc32ed333
14055969428fc76bc66b28491ff90d63
2b8b2136bdf153f722ecd721fabcf1aa
9dec231998f0f3d8301aa5c1a6e0119f
0affe53e87c71d2b7f9066427a5d71e5
3f92282b316430f68d847ff93565f264
1f4ab1b0f88d2b1805bcfbdaa2c461f1
3fadc54dc0f9a4e6af4b370749973ec3
2d43a582840285217ab6adaf45ff8c22
4ad98fe1fd6a020f491e31eb4aa16205
562254cc7ac0f92876c4964400fb6cd7
a261aa83665bed04243da16ecade0df0
bea91233ff3a67b260b02a18d7cb54c2
b1a5b5b97ab40559c62f27923a7322c1
830674c88d54f6aa3c6f1bcf72147f75

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /player1.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.everclips.net/page-4.htm?lid=937115

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: everclips.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 24 Sep 2016 06:33:49 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT

ETag: "4403c4-1bb61-4fbe0230ad080"

Accept-Ranges: bytes

Content-Length: 113505

Cache-Control: max-age=2592000, public

Expires: Sat, 26 Aug 2017 06:33:49 GMT

Connection: close

Content-Type: application/x-shockwave-flash

CWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ.....8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d........ .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6....UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O............w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s....ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T..... ....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f....9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h).._..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....

<<< skipped >>>

GET /analytics.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.sneezespoliticizing.pw/index5.php?id=13AxV6qwI0DELysbPzvn&date=2016-09-10&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 23 Sep 2016 20:31:55 GMT

Expires: Fri, 23 Sep 2016 22:31:55 GMT

Last-Modified: Mon, 15 Aug 2016 04:25:11 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11590

Age: 6948

Cache-Control: public, max-age=7200

...........}iw..........tc.m'.a.i|B...F6 ...%.6.F.....o..JR/..{.....s'V..VK..J.W..Hz...=....S....=$......l.j.......d....?Q...-..K...j(FR..W].b._..V.Ea-.6u.......D..gF.....[.<..W...../............`z.....g.l..~.............>..........GB..N....?...?.I2.....U...o<.....W.;...x qq......J.......zC.q...?.<.....P.."..[.|.....\P.c...[8.......FB;/..#..N.........,.:..}.mw.....Bx..?...r=&`..,Q....)j.v..f3.._.y....<.}..........y.5..l...fk..E.B7].X....%. h...6m...J$O.......!=.P,..$qo.....]]..8g?....f..Oj......M..b4.$.T$...{...R..^......_.63T-.e..#h7Y.F..~..}..Q....\..Z.2KKO...on8..%.!.n.."V<Qo.j......0. .o{2..u(uU..M.8.E..FDs6.y.....7..\..g.....x4.7<.......yg.{f.....>.k/s..V..k....)....s)..@...$QC.7..\.P*I..uI.E.........U..7.<.]Wy.0.....]............*.2.[.0 @e.1....qXT._... .!8..IO..........L%..}.6.%.u6'"...."*.>.........[.U]..O.k.p.........C'QwI......*..~(..B.v.g...&.y...@.f....S.9..........<....8@........r..R..=.y.1..M....D...G..P..O..s.v)/[.....q.......e.s*.aE3"p[..J.[Xj<}.....u...^^.=.....u.....V....sR....Z......Uo....P\........M.!,L..v...[....'.hBd.n.....rr....c..@=.o.N..|A....C..-.D...ju....E.t....s.......p$.7.HT....S...!.4....]./.X.......C.C.[.X....~..B.d.../.e.4..O.r*q`.....d.....b...t........../^6.jg:B........'....x4...w;D...J1.._`.@].s...'*U....&.a.KFD....<.....Y@.7.?U..a...P..J.V..\%...O'].Q...[.7....Fn...0tgA.2S.#-....._..%....q......f..9...zZ...l==.R .@..v...."......[.....".".;..YBf....~.....m.$....d42?.9f..K@........7.Q_..w.<-...;z..|..*..>...D...(?r.....@F.. ..P]...2

<<< skipped >>>

GET /r/collect?v=1&_v=j46&a=1328718889&t=pageview&_s=1&dl=http://VVV.sneezespoliticizing.pw/index5.php?id=13AxV6qwI0DELysbPzvn&date=2016-09-10&p=none&t=&ul=en-us&de=utf-8&dt=add&sd=32-bit&sr=1916x902&vp=679x408&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=1820530431&cid=275100794.1474669669&tid=UA-74694740-5&_r=1&z=1493545654 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.sneezespoliticizing.pw/index5.php?id=13AxV6qwI0DELysbPzvn&date=2016-09-10&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Fri, 23 Sep 2016 22:27:44 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Date: Fri, 23 Sep 2016 22:27:44 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2..Content-Length: 35..GIF89a.............,...........D..;....

GET /r/collect?v=1&_v=j46&a=49617149&t=pageview&_s=1&dl=http://VVV.everclips.net/page-4.htm?lid=937115&ul=en-us&de=utf-8&sd=32-bit&sr=1916x902&vp=850x480&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=394821786&cid=773942889.1474669675&tid=UA-74694740-2&_r=1&z=1049102214 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.everclips.net/page-4.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Fri, 23 Sep 2016 22:27:49 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Date: Fri, 23 Sep 2016 22:27:49 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2..Content-Length: 35..GIF89a.............,...........D..;..

GET /1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.everclips.net/page-4.html?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: everclips.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 24 Sep 2016 06:33:47 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.5.30

Cache-Control: max-age=0

Expires: Sat, 24 Sep 2016 06:33:47 GMT

Content-Length: 0

Connection: close

Content-Type: text/html; charset=UTF-8

GET /jwplayer1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.everclips.net/page-4.html?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: everclips.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 24 Sep 2016 06:33:46 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Thu, 02 Jun 2016 05:31:59 GMT

ETag: "4403af-25d37-53444eccf91c0"

Accept-Ranges: bytes

Content-Length: 154935

Cache-Control: max-age=2592000, public

Expires: Sat, 26 Aug 2017 06:33:46 GMT

Connection: close

Content-Type: text/javascript
var dtn = Date.parse(new Date().toString());..document.write(unescape(
'
>>

GET /img/logo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.everclips.net/page-4.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.everclips.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1474669675.AE6DCCEC6DE64FDB7C6913056BE81137.1.1.1.1.1.1.1.1.1; _ga=GA1.2.773942889.1474669675; _gat=1

HTTP/1.1 200 OK

Date: Fri, 23 Sep 2016 22:27:49 GMT

Content-Type: image/png

Content-Length: 2813

Connection: keep-alive

Last-Modified: Sat, 01 Nov 2014 03:24:47 GMT

ETag: "a1d83-afd-506c3a7ca5dc0"

Server: CDCE

X-INAP-Cache-Status: EXPIRED

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Accept-Ranges: bytes
.PNG........IHDR.......L........@....gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<....IDATx..\.OTW.G......]../.E.~..(6M.[:.......`V..
...i..&U.Y!..c"D.......tE.d...d?......;..0..s..s.}.;/8../7f.{...9..&lt
;o..[~.. ..H=...0.j.....Tc.-^....*0..12...Qcl...i.v.......(......`l..e
..`..`.1...2..1..16....-..S....[c....9......m....?..g.1.....w.(,......
\\^......<  ..~~....?o\/*x....y.\..T.s...@...>h.....`R0....w.i..
vX.QRAY.n.3..?......qZ...n..z..kcl.:...2o... ..!;3t....1......m.{.....
....53.'S.1.n..Z.....K ?........E...*b.G....~...q..=....S.U..8...~y.k|
.....s.N...B...j.....Cy.6.>...X.eL..%N.6.g:>........:cf..@.(....
.TKx....J.........G.1.!)...Aa.@.....]]...V.A.&....&.7.....I.`8.L.:....
.P.{.......:.P....@..3.'.........K.....7.6@a.w...L........]....|.}....
..........u...r...Y........u.!Z...!..7p........Sc%.....A.....M.y.F..}.
...T.g...~J'.....o$..>y.2.]Un1.t.l.;5........c..g.....j.ZV.A..a....
..!6..8........h.n.;...'. ..n......o...ZR..)...Kf..`.m..XA...&.6..b...
.o....8<hx..7../?-..$k.....}.xl.C..BtE..z..~/j...3....ax.M......].r
..1..Y.._..m..h..>}w..@.....%....*g....m.5..B~H........AJ.$7j.`....
...{K.........8v.....g..........3h..{.C'n..E.mj.....R.%"t..........%. 
aW.)!..S$.".S..D6B......|W.3.C..$ $...0........c....zO..].}..@..]..u..
..F.....U.M[....`>....Y.S.[.jl8@.........P.pX/@..%3..M.....SF'n..|.
Xw.b...j%...{Z...b../..].=L...nl|J?....<.You......[d..n..Z.%.'.....
..l....:.p..H..?@o-.....#i.bG-u.....i.5/.q0d..W":.n...l........r.....}
.,..P..&.....pw....6.1K...........WSO....<e......x&...:.. ..mz.
>>

GET /5/10/logo.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://everclips.net/player1.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: l.longtailvideo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Fri, 23 Sep 2016 22:27:51 GMT

Etag: "3015243340"

Expires: Fri, 30 Sep 2016 22:27:51 GMT

Last-Modified: Fri, 22 Jun 2012 18:10:31 GMT

Server: ECAcc (arn/46B0)

X-Cache: HIT

Content-Length: 1845
.PNG........IHDR...].........9.".....IDATh..Zo..E...e...*!.......RP...
.0H.|).Y...).4C.#H..2....g{.....GO.....A...(.?H....B..wf.....{.......c
v..9sv...3g....A-.).8j......J..*.Ge9.@....Y u(.....k.Nt.3..yR....~*]. 
...Y...v..........\.YO....0.....bZ.=...e..ji.g..S..Z.t.9?..N).]`.K !..
...Y..?..<.h.v.<.........%..6.O.......R..g.}.i.?.Vh.....?..[..C{
.h.-%......s.\..:.M.p.K..u.5....c...X.>..........m.........._.%.d9k
L....t..t..N...#...|..VV.2...w.....X.W:^.:.S...n6....E=...$.i......(.j
.}S...@.EmE./.....U.u.-.U\..../B......;..Q......@.9....=.'.~Jm0t<c.
]...-....D...~......<...X....&....Ky%..j...[...Nk.6.....7.._.e!h...
........T7(q..q..v.J=c.^..............--.>......=.....n."...("....0
.Z..<... .q!.`.....N...Z....b.....g.,..UjA.j..7{.H...Pa.. /...l(...
S.j.Q0.u`...LcthJ.. .BN..............P....e...BPZ...W.I...........Sc.j
.!..'..d>c.....xV..2.i#.Z...#j >wa.......[.Y.../.6.g.j'.m...y..O
.\..W.....ar.J~..B...0...........~1M....].......;f...>>$...h.{..
....>zpI/...!>........0...f..ez.....b..!.....X....R..H.l|.r9.#'.
...x..1.A.qy.......M......Y&}..I...-} ..X.....(..17(...EJ.l..T..(8;.`.
..8o.{..r@..]..Z.......^n...vy.3S....%^'....)..nDeg..'.1. $....C...x..
t...x.d#.......t...?...N.N.............%`..Kc....#4.x....#.....9.ps.a.
q........G..R..........B... .S.K$......]..2..-..Hn..t'....4UA9P..69Q.'
.......2..d.<b.....{m....).dd...d.(..G.1`*.....<..ql.zs.On......
j..$..Fnf.T.Y........}.z....N.ZS.]........U)..K...xJFf........S....&.b
i..Mv.F..r....Z...`.~_........._ y.......(.b..f..m....R..k......se
>>

GET /index5.php?id=13AxV6qwI0DELysbPzvn&date=2016-09-10&p=none&t= HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.sneezespoliticizing.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 905

Connection: keep-alive

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Encoding: gzip

Date: Fri, 23 Sep 2016 22:27:42 GMT

Vary: Accept-Encoding

X-Cache: Miss from cloudfront

Via: 1.1 703bf8982f0d6cb88970f726e75970fc.cloudfront.net (CloudFront)

X-Amz-Cf-Id: fwQ_Y4T5MtTEItCp9-Vr4vary--p_hp-3c2kCCf7w1eJ-vK_IEO4hw==
...........U.n.8.}/.. ..I]Y.\7.. m.&....f/...Z.KL%R!GV.I..$...O...M...
9s..g5..|V./.........2..j.3...\#v.......'..M>...(..PR(. .....e.qQk.
......5.4......,.'Q`.s^..t\..1..*7....\WB2.Q..{.S....-..=...d...S:..n&
V..@...u....0.I.pY-{.U &B.TZ.^b....(Y.w......*;..ec.....;%G`.Y~8..'y..
1.$. ..\...A.X3.SR..j.K..R......Z5....RY.....\.0.s.......e...4j@.....Y
l..~.{.....5.J..2..T`.....aa..D.v...`.EA.U_...;B.U/..J."6...X.<n.{.
.> U5p&y.AQ._..P`p..T,..s_../..{..Y.;6.<<,n...M....mS...c.lX.
A.@.-.0.rf.B..\4...*.]..:*.'..............'.ld.r.r...m..._T....h.. .!t
.\..(..,.....Y..X. ....<......y...{..A4u%&..a0f..$..<.?<.?..&
...{T..x..,.......Oaf..UO...t...Sz..|.....WVdz..........n.>.......b
.>.LDk.4....E...m..WB.H.,.Z.........U.e"...j.u.S.f......i@~..:.....
'.~Gm..F.....k).....H....h.nNjQ. m .."....>I.=<.k.N...Q.........
...)..<.?..4K......|/.Sj.m..%.].__Z._^\}..v.`D2....K?.^dH...m.Y.Ji0
2...t.s.....N5;../us...3......:...HTTP/1.1 200 OK..Content-Type: text/
html..Content-Length: 905..Connection: keep-alive..Server: Apache/2.2.
22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Encoding: gzi
p..Date: Fri, 23 Sep 2016 22:27:42 GMT..Vary: Accept-Encoding..X-Cache
: Miss from cloudfront..Via: 1.1 703bf8982f0d6cb88970f726e75970fc.clou
dfront.net (CloudFront)..X-Amz-Cf-Id: fwQ_Y4T5MtTEItCp9-Vr4vary--p_hp-
3c2kCCf7w1eJ-vK_IEO4hw==.............U.n.8.}/.. ..I]Y.\7.. m.&....f/..
.Z.KL%R!GV.I..$...O...M...9s..g5..|V./.........2..j.3...\#v.......'..M
>...(..PR(. .....e.qQk.......5.4......,.'Q`.s^..t\..1..*7....\W
>>

GET /func.js?r=5 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.sneezespoliticizing.pw/index5.php?id=13AxV6qwI0DELysbPzvn&date=2016-09-10&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.sneezespoliticizing.pw

Connection: Keep-Alive

Cookie: _ga=GA1.2.275100794.1474669669; _gat=1

HTTP/1.1 200 OK

Content-Type: application/javascript

Content-Length: 597

Connection: keep-alive

Server: Apache/2.2.22 (Win64) PHP/5.3.13

Last-Modified: Mon, 18 Jul 2016 15:25:49 GMT

ETag: "90000001e1520-f7a-537ea953f7333"

Accept-Ranges: bytes

Content-Encoding: gzip

Date: Thu, 22 Sep 2016 16:26:55 GMT

Vary: Accept-Encoding

X-Cache: RefreshHit from cloudfront

Via: 1.1 703bf8982f0d6cb88970f726e75970fc.cloudfront.net (CloudFront)

X-Amz-Cf-Id: k8a5e2uRaES_Vt3bNCJb9qCfvvbrAx4gqkI_JmxLLc-Pfc29Zv5QcA==
............MO.@...H..k/vJ.8....U U.R.q.z..N.......DU.{....-.G.>l&l
t;3..wVyd.Dk.b.y..d..T.D...."W.<K.n4,X.$........AU5^..{.]_M..:.]...
..Z P9.p9.F?....'...d.|..o..[e...8E...{.4.U.BrB.<......> .X.9...
...P.B...i.J..L....V ..jr*n... ]v..g@.. .M.u.v&]..~..Bz_."..:.]... o..
.T.B...q....pC..B..qM...J.<J.....c]..s>...V:.......[a=..|..x.z..
...=.9%}.t......T........'..t...g.....L.. *.V2..p...rv.....F..x?W..*..
..........3_.q.q....S.~....7_e.G..P..7w..h..R ..$.w....H.41.W.n...D...
.wZ..x.ZG....6..:a.5!....t:O..:.5MvM...(...f.@..S.\.......SuY....:....
.....>...P..{|:.<.<...I...=........}..=...|.8.......{1z...HTT
P/1.1 200 OK..Content-Type: application/javascript..Content-Length: 59
7..Connection: keep-alive..Server: Apache/2.2.22 (Win64) PHP/5.3.13..L
ast-Modified: Mon, 18 Jul 2016 15:25:49 GMT..ETag: "90000001e1520-f7a-
537ea953f7333"..Accept-Ranges: bytes..Content-Encoding: gzip..Date: Th
u, 22 Sep 2016 16:26:55 GMT..Vary: Accept-Encoding..X-Cache: RefreshHi
t from cloudfront..Via: 1.1 703bf8982f0d6cb88970f726e75970fc.cloudfron
t.net (CloudFront)..X-Amz-Cf-Id: k8a5e2uRaES_Vt3bNCJb9qCfvvbrAx4gqkI_J
mxLLc-Pfc29Zv5QcA==..............MO.@...H..k/vJ.8....U U.R.q.z..N.....
..DU.{....-.G.>l<3..wVyd.Dk.b.y..d..T.D...."W.<K.n4,X.$......
..AU5^..{.]_M..:.].....Z P9.p9.F?....'...d.|..o..[e...8E...{.4.U.BrB.&
lt;......> .X.9......P.B...i.J..L....V ..jr*n... ]v..g@.. .M.u.v&].
.~..Bz_."..:.]... o...T.B...q....pC..B..qM...J.<J.....c]..s>...V
:.......[a=..|..x.z.....=.9%}.t......T........'..t...g.....L.. *.V
>>

GET /page-4.html?lid=937115 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.sneezespoliticizing.pw/index5.php?id=13AxV6qwI0DELysbPzvn&date=2016-09-10&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.everclips.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 23 Sep 2016 22:27:44 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.3

Server: CDCE

X-INAP-Cache-Status: HIT

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Content-Encoding: gzip
bb9.............Zmo.8......\..qnc....y....n.K. uoQ.E@K..D.T...v....R.e
...l...m..&.!.3.yy....gi...@.x.V...f.n.V.m...D.Q"-3...GI`..X$N..i-.}Qm
..9....k.6.Y...x m.`.......l ...}u.s.:..K&....)>....s.k.1R,d...&q..
"......4E>_g..&..q.mD.....o_pq!/J..;...BV....g3...e..............N.
.'.......\...uE...,.6.....L.aZ.......0.c...f.9.x..f.......27rFC.Js..RT
6....XB.."w.z}'...6...?.9.OS......C..}.....'g........U..1..$=X.....*..
*<.R.a#W....LG../ .....%7..~..%.uz.f....I4..J(&..C5.&........U..7.5
..7LAu.$|Z......So:...M46.T.....d....^....W..{.4..d. .......;."...<
j..]...%.O......RW.........{.g.._...h.9.F.R.....{..R.........., .%..J.
^.EIEK..n4.l.S=6....`.c&F................N4....6g`x..*...W.V..B..P$..f
*.(.|}......@.,c..~.Yd.-.x.........'..3..%..v..B...(.<..).. B.k.K..
6F>y...Z.L..~.1#./p..h{.P.1..W...."..'..Q..h.Z.L.(s....@.)..~*O`...
1..#x.J&e.9.K.....n.&b..a.4Q....]N._..U6..u. .C.}....n..>b.....$Hf.
..(..DK....G.O..]p.RFC.(...8..;....k^...L.>.t.u..d....(....lp......
G....:....Q}.t...rca/q"..l.....a.. .......id.L...w.....q2..i.I..,~..-.
.<.!9=...9.......L ......0.9w_F..'.J{..~........9vZ.Y...<..z.q.i
......y.....C).:.......R.%......&:....4'......E.i.:.z......:C.8....kv.
.O.......'!....c..f.Z0.....R..s.vA..S..~{:m..........L...A...\..._HM..
O/....8=y.......n....S..}......<\6..........9?=|.....7g....n.......
......J=...4.q...I....]...............I..x.3....v.B...y..)5.qY.c......
.1.....-.t...K.l1.A..o!6......H.-F........d../|.P`B~.R.h$ 4.....9.....
.*;T......N..c..Bi....f...h.6....0lD.6w....f|.5...Tt....,.U..E.M..
>>

GET /page-4.htm?lid=937115 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.everclips.net/page-4.html?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.everclips.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 23 Sep 2016 22:27:47 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.3

Server: CDCE

X-INAP-Cache-Status: HIT

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Content-Encoding: gzip
dd6.............Zmo.8......\.....l9.{."m.m.....-.A...e .%U...m..=CJ..8
.....p...Eq...p^.r...X.8...2.i6....nY...2;.f".(.......$..b$.'......ht.
..<.|..^...u..@..... ...2X_..>.Z..^.$~,....6.... >..........z
...ODb.W).ij.|...O....a..].....}....(.0.H?..Q..cs..L$....B.#.6zB.,..,8
....Gb.~..s9.}..a...4...C.d2..i........|.Ue..A.p..'.."..........D(.q.K
Q....w1...F..u{N.D.m..S..s....Ao....<.......ON.. ..[0.....L.N..)...
D...L....J.R;o_.........h\...G.$5@.w$..#..6..o...p.Pr?...SN..#.R.....i
....%Q....]%..K...Z.Z..........)...'.....@..x......o&.0t....C...L...?.
/.dV....j.(w... I..Z.....Sw2.Z7&.*u..w6.>...&...n.....n:...Yj...*.3
cm.>..:(...r..'n....7.za...|v...QRj.=.._..JMI4........7p......{=/l.
...,..B..\....(.j.rX..Z.E.6...d.v.....@.6w..?0G.;..............N....*5
3.r.W...0....k.f....9....c.......: ..........[F..|(a.<..(.. B.k[...
.z..<10W(S4..'...Sx....a.\.l..KD...'..4....75.u.q..fB $.....?...L..
.....kU3)...V..^....4..h.......]..U Yd{.].i.....m..J.. .f:...fj.O..{c.
'.... .(..DK..Y.....)e40.R....!<h....f....$.CI..{.$....z).. .....m.
.|........P...../......'..............=.A..?.,.i....~...#...1M.X?`.?..
..w....^.....uibA.$.H..l?.Mt|.... ....n......z.......z..Zg'k[...$s...t
.x..|....J.P8.....E.2....X.u4..H.o.9v.....D.^.U.W..9....e..q..7....L..
....`.$$y..u...T]s.1}..Zz(.|D. ....Vok2i/.........T...A........K_G...^
.||.........C{mkk.....^.>z{`#W...(..K.......9..{.O/..;;zw...u|x....
..G-...3..a......g....-j;98={wt.!.2........{..W......9y.t)=.......7\..
.c*m.#.[.h3a.I............D../...h._:<@...lR...[.L..U...e....y.
>>

GET /style.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.everclips.net/page-4.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.everclips.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1474669675.AE6DCCEC6DE64FDB7C6913056BE81137.1.1.1.1.1.1.1.1.1; _ga=GA1.2.773942889.1474669675; _gat=1

HTTP/1.1 200 OK

Date: Fri, 23 Sep 2016 22:27:49 GMT

Content-Type: text/css

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Fri, 05 Dec 2014 02:43:45 GMT

Server: CDCE

X-INAP-Cache-Status: HIT

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Content-Encoding: gzip
2e0.............VQO.0.~.R...j*.......T.lh@%..moN.&.N.9n.U.......j.4..G
n...w..}....E.v<>._.h...@.6.}.x'....pr6.$.......zmH.HoP...z.t|9.
N..g...|.....`...-.......$.i..\.)....;.....@g/....E..g/.A..\..}C....O.
j;.V..^.Q.0...b.R.Mi".=)s7p.\.....e.5.@.{.....?}....<.......J..D.I&
gt;5.zo..-...a....k..:.J........~.j.eT..t...w.....@......yG=..J...{...
..m. .\.A.7U...t..^..G. .....uqx.<...6..<Q..".... ....(oD.)mP.8.
~..1e.....e.....n..o....$....z.3.5..=.J.)....7.V...0.{rF5O......I.>
."?K....P..W~a..c.......{,4....H>ht...n.,..Ki]..vu.R..Kj...n|..va.K
...J8.KD.....c.G.....x.FV.x...N.....)g.`..E..4...,....k.>..Jh......
i..jf...........2f..i......U.m....l..#.|k.V0.#..zU.*E.g....V.K.%..I..`
...... ...%:.......^.)..x.[Y5.....r....X..O.S.s*Y.)...@....'.-.;f.....
0......


GET /img/bgg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.everclips.net/page-4.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.everclips.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1474669675.AE6DCCEC6DE64FDB7C6913056BE81137.1.1.1.1.1.1.1.1.1; _ga=GA1.2.773942889.1474669675; _gat=1

HTTP/1.1 200 OK

Date: Fri, 23 Sep 2016 22:27:49 GMT

Content-Type: image/png

Content-Length: 198

Connection: keep-alive

Last-Modified: Fri, 31 Oct 2014 16:20:09 GMT

ETag: "a1d82-c6-506ba5ee06040"

Server: CDCE

X-INAP-Cache-Status: EXPIRED

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Accept-Ranges: bytes
.PNG........IHDR.......L.....0f......gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<...XIDATx.b.R.b....p.Z..00.'O...r...;...`r'^....4n!
7\h..4I...wZ";..=...<.*e.`..-..`J..)......m....?N....IEND.B`.HTTP/1
.1 200 OK..Date: Fri, 23 Sep 2016 22:27:49 GMT..Content-Type: image/pn
g..Content-Length: 198..Connection: keep-alive..Last-Modified: Fri, 31
 Oct 2014 16:20:09 GMT..ETag: "a1d82-c6-506ba5ee06040"..Server: CDCE..
X-INAP-Cache-Status: EXPIRED..X-INAP-Server: cdce-ams002-001.ams002.in
ternap.com..Accept-Ranges: bytes...PNG........IHDR.......L.....0f.....
.gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...XIDATx.b.R.b..
..p.Z..00.'O...r...;...`r'^....4n!7\h..4I...wZ";..=...<.*e.`..-..`J
..)......m....?N....IEND.B`...

GET /draw/?w=colored&n=1660&c=000000ffffff&p= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.sneezespoliticizing.pw/index5.php?id=13AxV6qwI0DELysbPzvn&date=2016-09-10&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: uid=CgH9JVflrGBoYWb/Fn2PAg==

Connection: Keep-Alive

Host: widgets.amung.us

HTTP/1.1 200 OK

Server: nginx/1.9.6

Date: Fri, 23 Sep 2016 22:27:45 GMT

Content-Type: image/png

Transfer-Encoding: chunked

Connection: keep-alive

Content-Disposition: filename=wau-widget.png

Expires: Sun, 23 Oct 2016 22:27:45 GMT

Cache-Control: max-age=2592000
600...PNG........IHDR...Q...........p.....PLTE...EEEYYY............???
,,,...AAA........................;<=.........abdWXZ................
..GGG<<<.........'((...............uvyEFGzzz""".........kln..
.NNN..................~~.vwx...hhi.........OPQ...{{{..................
...uvv...opp......UVV...ooo............bcc...ijj}~~......dee..........
..QQQ...]^^PPP.........TTTaaaVVV......yyy.........___......HHHrss.....
....kllJJJDDD|||BBB...RRR.........CCC.........LLLNOO.........@@@tttkkk
vvv:::....................................?@@888666ppprrr.............
..KKK>>>FFF......111............000...lll......XYZ(((&&&hhhff
f   cdeZ[\788...dddccc.........nnn.........ZZZXXXVVV[[[mmm^^^\\\]]]```
gggxxxjjj........tRNS.@..f...,IDATH....S.A........(*..b......P...r*...
[N.A.%.@.U!..)....@T...%......s.p.....~..yf..I.a.......1P..m...p.{...;
].?-...*..?.....w{.......g~..E.....oh....~e..jkj)_.?.T....5.x...G.....
=.......n.TUvZ{QQ.o..JK._.....gQ..R...xn).._`qQ...<.;y.].f..y.$.g..
L3.<~d2..>..o.'..&.c....;&9..i...85...\#...t.f.p.:p..y...._.....
.u.z9../.... .b3M.5&.e..9M9..dY....'X .8....2...........$E<C....&lt
;@......q....H.."..{W..wB..U.t.:x&.....Rb.l..n.m..u.M$m.M.1....e.5...D
....m"<....N....Nq.....U.@.......Tb.|Y..R..R...K..&D...Q..."hj5..#.
E!HJj.......I...J-N.A.F...FM0R).\.....H=N.....j0 .........<w..La..B
.b.....f..E.,..B4j.*?.......L..3.....(i.I-....Ec.A...E`..m.....T......
h.'m\.....XX).....{U.....T({....1.L.!.}...x...%..;.....8..*.. ./.....Q
/ZF..}...q...J.Qx..g.B4|X..`L..H. ~o4>.>n4......... .}..C...
>>

GET /itd.php?id=13AxV6qwI0DELysbPzvn&date=2016-09-10&p=none&t=&rand= HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.sneezespoliticizing.pw/index5.php?id=13AxV6qwI0DELysbPzvn&date=2016-09-10&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cocomo.tremorhub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 23 Sep 2016 22:27:45 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 1118

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html
<html>..<head>..<title>a</title>..</head&gt
;..<body>..<script language="JavaScript" type="text/javascrip
t">..<!--..function reeadCookie(name) {..  var nameEQ = name   "
=";..  var ca = document.cookie.split(';');..  for(var i=0;i < ca.l
ength;i  ) {..    var c = ca[i];..    while (c.charAt(0)==' ') c = c.s
ubstring(1,c.length);..    if (c.indexOf(nameEQ) == 0) return c.substr
ing(nameEQ.length,c.length);..  }..  return null;..}..function uapcc()
 {..//var paathname = reeadCookie('tvrg_60409');..//if (paathname.subs
tring(0, 2) == '"4') {..//eraseCookie("tvrg_60409");..var date = new D
ate();..date.setTime(date.getTime()   (60 * 1000));..var times = Math.
floor(Date.now() / 1000);..//document.cookie = "tvrg_60409=1," times "
;domain=.tremorhub.com;path=/;expires=" date.toGMTString() "";..docume
nt.cookie = "tvrg_60409=;domain=.tremorhub.com;path=/;expires=-1";..//
}..}..setInterval(function() {..uapcc();..}, 90);..setInterval(functio
n() {..uapcc();..}, 90);..setInterval(function() {..uapcc();..}, 90);.
.setInterval(function() {..uapcc();..}, 90);..//-->..</script&gt
;..<meta http-equiv="refresh" content="300">..</html>HTTP/
1.1 200 OK..Date: Fri, 23 Sep 2016 22:27:45 GMT..Server: Apache/2.2.22
 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length: 1118..K
eep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: t
ext/html..<html>..<head>..<title>a</title>..&l
t;/head>..<body>..<script language="JavaScript" type="
>>

GET /counter/counter.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.everclips.net/page-4.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.statcounter.com

Connection: Keep-Alive

Cookie: __cfduid=d1cff9e4b2c96069e5be53bf39bd943af1474669664; is_unique=sc10114910.1474669664.0; is_visitor_unique=1474669664119144014

HTTP/1.1 200 OK

Date: Fri, 23 Sep 2016 22:27:48 GMT

Server: PWS/8.1.41.3

X-Px: ht h0-s1133.p11-fra.cdngp.net

ETag: W/"576924c5-654e"

Cache-Control: max-age=43200

Expires: Sat, 24 Sep 2016 06:08:06 GMT

Age: 15582

Content-Length: 9529

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Last-Modified: Tue, 21 Jun 2016 11:28:05 GMT

Connection: keep-alive
...........]{s....*....F.,.-..o..M6....$...eQ$%s,.Z..c-}..u7@..<3{u
..?....@.h4..B.y..Z...Q..9..............]...K.%.<L....f...U...\..i.
<..g.f.%.q........O.J.CH..v.....N.H.M..zQ-J..`.'f.*~0....sj....C...
.....l....di|..4t..H........-...;.P.f^...EM....4..I.=.~....e..e..W>
.]..Wt...v..I..Wym.;...y....'....W._;.}.f..#...'.4Lj.:...bv.....&Z.p.&
.&.5.n#sN....X'[..........5-h.n.x..G.5....h...mp.....5..[..G.}.~....&.
...d.%i..G..4....b..h......<.q..c... J....{bTZ\M.w.r.1.Bf...y.l....
v.gQ...v.e./O.....Fi..H..;.Z.Y.a{Os-.A..c.b.c.{.a.....bln|{..t.....:|.
....~......R.eEV..-:h.xwS...Zf..*cHC,...K....p..4i.9.k>..P6[.Q.....
.$|...._.;...Em..itPa......P..Gj.. .5.  G..1m.....Ee...F70..ZUU&.&.?.&
gt;..r.Opc.........MQ<....=9(.v..^.Z<.;C....{....v..v:..N..{8.V;
........a.......v'.......w:...y..... ..^v../.8....W..7...o..IBV..%e...
c.Qt...6M.k.".j.o.E[.;..(#.$...#..T*. .......K/M..S..X.;(`..v.Fx||4...
..............#_.y..]./.y...?.....U...... ..].@...JX....v.?.H.ha8.b.*.
.EE.tx,j.....,.H..;.^...Ps....\.D.A...._..M...`.K...$k....^......j5t..
.......J.G,kt..6:}.I....v%..g.).([......Rlh.F.E..P(...h.U...:.@k>D.
..y.($V.P..B.u[n...[.@u2...;r^.E./..u....-k.......u....K....w...`U....
g^.l....*.1N.....8|.b..R.N.N..yq.s......?..m.m~..^...m.<cT. ....g.c
...E.-.?...O.|O. /Z*l...../46..;......h...8..p....m......&..MD.[.f\...
.'..e..C.*.n..#.....-...h.M..Lj$.....@O....h.,6<,.:..8,.OA...V.`.Pa
[..~v3.Qn...7W..^@[...../ m.t..%.......r$...>-k...{..U .h.r.._...UN
....3../....O..N.............p....5.<....2GM..C3|.q^w.....,....
>>

GET /player1.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.everclips.net/page-4.htm?lid=937115

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: everclips.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.773942889.1474669675; _gat=1

HTTP/1.1 200 OK

Date: Sat, 24 Sep 2016 06:33:50 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT

ETag: "4403c4-1bb61-4fbe0230ad080"

Accept-Ranges: bytes

Content-Length: 113505

Cache-Control: max-age=2592000, public

Expires: Sat, 26 Aug 2017 06:33:50 GMT

Connection: close

Content-Type: application/x-shockwave-flash
CWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....
y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V
$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ..
...8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d..
...... .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6
L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6..
..UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O......
......w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .
y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s.
...ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....
r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS
.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....
'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..
=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T..... 
....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f.
...9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8
...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O
.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[
k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.
2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h)..
_..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2
V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....
>>

GET /ova-jw.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://everclips.net/player1.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: everclips.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.773942889.1474669675; _gat=1

HTTP/1.1 200 OK

Date: Sat, 24 Sep 2016 06:33:52 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 14:00:26 GMT

ETag: "4403b3-39741-4fbe0551c3280"

Accept-Ranges: bytes

Content-Length: 235329

Cache-Control: max-age=2592000, public

Expires: Sat, 26 Aug 2017 06:33:52 GMT

Connection: close

Content-Type: application/x-shockwave-flash
CWS..A..x......U.8.!.o.{.l/.B...$.@....Nx......A...Uuw........!AQD.e.q
. ..(...?""..,2:.u.....t.....`....9w.[..u:q....}..~Uu.s.=..........b..
.k[R..l...;../K.........=...|..!O;.M..........3.m6K..[/....-...m."%...
BY..*Xk.....t W2.e.,..Y.3 .....V..h.X)..I-....).P...n.J..r=.fiJ-.T....
S.....k....Q.....jMn...B..Q..;3.9.......y..].K."PX...S....7....b..*92.
q..V..@...X..&...J.p...].o.L...e.Y....y.0QQ'......x.1.e}.e.|..-....l.F
..o.w.......Y......u.g......-% .#.[....:..../x.".....i..d...uuK.K.....
.tF.V.9]K.8.....9isZ/...4.KN.,.0...[...U)....i.,...o../S...,..S-]...&.
.......Q..RZ.....nm&.. ....'.ROz.J.0......_.C....~zG..... ....~C...t..
;=`...t^.....B...48.[3..Sd(.J..D4b.H.....U&&`.;..RE.../..i..X.......u@
..).......{..k.....`.@.7...... i....rI....I]LgL/..z....H.... t...|..Nk
..`...U(..?..u.#w...X"...NK\u...7.\....7.\}...o...wvO....R.d3.&Im..f}V
.....e.T..%c|...:.pQ..j.`...l9=.Zi....q..#...5...0...iw..C..j...|..%.\
)...K..... .............u.`. E2...f.*@.6....NPmJ'......L....(m.c.r.Z.H
W....f.....Y......_...7......p1..a.zx.u...go....O......!.......GNE..J6
a........3.......Mg...........Z.>.*..s.....%..<iX.5ZKlt...0.V..F
.....Ex...Y2.5R...S....J.....q .N2..B.. ..M.Z..O....../..E............
..&`".%.AZ..g3p..$.@.0..&.d....i....~....................&3p4OFb....T.
.O.J....M.....O?...jv..6.........0x.....#..;.....}..i....W....]....&.V
..a.pO...&.f:..V5}.yK.YM.e........4..:.`...].)......2.... ....uD......
p..g./.AC.....bh8.....L..'"...;;/q..-..>:Y2 ........\.D....=.......
...).0..W....69V.H.....O..N.....W.P....."hNdG"cA..........{3.;7.j&
>>

GET /1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.everclips.net/page-4.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: everclips.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 24 Sep 2016 06:33:49 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.5.30

Cache-Control: max-age=0

Expires: Sat, 24 Sep 2016 06:33:49 GMT

Content-Length: 0

Connection: close

Content-Type: text/html; charset=UTF-8

GET /report1.php?url=/everclips/page-4.html?lid=937115 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.everclips.net/page-4.html?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 23 Sep 2016 22:31:15 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Fri, 23 Sep 2016 22:31:15 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8......


GET /bck.php?1474669672000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.everclips.net/page-4.html?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 23 Sep 2016 22:31:16 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Fri, 23 Sep 2016 22:31:16 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8......


GET /report1.php?url=/everclips/page-4.htm?lid=937115 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.everclips.net/page-4.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 23 Sep 2016 22:31:17 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Fri, 23 Sep 2016 22:31:17 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8......


GET /bck.php?1474669673000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.everclips.net/page-4.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 23 Sep 2016 22:31:18 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Fri, 23 Sep 2016 22:31:18 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8..

GET /10114910/0/757d7213/1/ HTTP/1.1

Accept: */*

Referer: hXXp://VVV.sneezespoliticizing.pw/index5.php?id=13AxV6qwI0DELysbPzvn&date=2016-09-10&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.statcounter.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 23 Sep 2016 22:27:44 GMT

Content-Type: image/gif

Content-Length: 49

Connection: keep-alive

Set-Cookie: __cfduid=d1cff9e4b2c96069e5be53bf39bd943af1474669664; expires=Sat, 23-Sep-17 22:27:44 GMT; path=/; domain=.statcounter.com; HttpOnly

P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Set-Cookie: is_unique=sc10114910.1474669664.0; expires=Wed, 22-Sep-2021 22:27:44 GMT; path=/; domain=.statcounter.com

Set-Cookie: is_visitor_unique=1474669664119144014; expires=Sun, 23-Sep-2018 22:27:44 GMT; path=/; domain=.statcounter.com

Server: cloudflare-nginx

CF-RAY: 2e716cfc4148404a-SOF
GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date
: Fri, 23 Sep 2016 22:27:44 GMT..Content-Type: image/gif..Content-Leng
th: 49..Connection: keep-alive..Set-Cookie: __cfduid=d1cff9e4b2c96069e
5be53bf39bd943af1474669664; expires=Sat, 23-Sep-17 22:27:44 GMT; path=
/; domain=.statcounter.com; HttpOnly..P3P: policyref="hXXp://VVV.statc
ounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"..Expire
s: Mon, 26 Jul 1997 05:00:00 GMT..Set-Cookie: is_unique=sc10114910.147
4669664.0; expires=Wed, 22-Sep-2021 22:27:44 GMT; path=/; domain=.stat
counter.com..Set-Cookie: is_visitor_unique=1474669664119144014; expire
s=Sun, 23-Sep-2018 22:27:44 GMT; path=/; domain=.statcounter.com..Serv
er: cloudflare-nginx..CF-RAY: 2e716cfc4148404a-SOF..GIF89a............
.......!.......,...........T..;....


GET /t.php?sc_project=10675947&java=1&security=299981d6&u1=AE6DCCEC6DE64FDB7C6913056BE81137&sc_random=0.14739253353705806&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1916&h=902&camefrom=http://VVV.everclips.net/page-4.html?lid=937115&u=http://VVV.everclips.net/page-4.htm?lid=937115&t=&sc_snum=1&sess=a181b5&p=0&invisible=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.everclips.net/page-4.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.statcounter.com

Connection: Keep-Alive

Cookie: __cfduid=d1cff9e4b2c96069e5be53bf39bd943af1474669664; is_unique=sc10114910.1474669664.0; is_visitor_unique=1474669664119144014

HTTP/1.1 200 OK

Date: Fri, 23 Sep 2016 22:27:49 GMT

Content-Type: image/gif

Content-Length: 49

Connection: keep-alive

P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Set-Cookie: is_unique=sc10114910.1474669664.0-10675947.1474669669.0; expires=Wed, 22-Sep-2021 22:27:49 GMT; path=/; domain=.statcounter.com

Set-Cookie: is_visitor_unique=1474669664119144014; expires=Sun, 23-Sep-2018 22:27:49 GMT; path=/; domain=.statcounter.com

Server: cloudflare-nginx

CF-RAY: 2e716d1747c6404a-SOF
GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date
: Fri, 23 Sep 2016 22:27:49 GMT..Content-Type: image/gif..Content-Leng
th: 49..Connection: keep-alive..P3P: policyref="hXXp://VVV.statcounter
.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"..Expires: Mon
, 26 Jul 1997 05:00:00 GMT..Set-Cookie: is_unique=sc10114910.147466966
4.0-10675947.1474669669.0; expires=Wed, 22-Sep-2021 22:27:49 GMT; path
=/; domain=.statcounter.com..Set-Cookie: is_visitor_unique=14746696641
19144014; expires=Sun, 23-Sep-2018 22:27:49 GMT; path=/; domain=.statc
ounter.com..Server: cloudflare-nginx..CF-RAY: 2e716d1747c6404a-SOF..GI
F89a...................!.......,...........T..;..

GET /cwidget/iebrowser1/000000ffffff.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.sneezespoliticizing.pw/index5.php?id=13AxV6qwI0DELysbPzvn&date=2016-09-10&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: whos.amung.us

Connection: Keep-Alive

HTTP/1.1 303 See Other

Date: Fri, 23 Sep 2016 22:27:44 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Location: hXXp://widgets.amung.us/draw/?w=colored&n=1660&c=000000ffffff&p=

Set-Cookie: uid=CgH9JVflrGBoYWb/Fn2PAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=.amung.us; path=/
0..

GET /count.php?id=13AxV6qwI0DELysbPzvn&date=2016-09-10&p=none&t=&rand= HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.sneezespoliticizing.pw/index5.php?id=13AxV6qwI0DELysbPzvn&date=2016-09-10&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.clangburkitt.info

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 23 Sep 2016 22:27:45 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 47

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html
......<meta http-equiv="refresh" content="300">HTTP/1.1 200 OK..
Date: Fri, 23 Sep 2016 22:27:45 GMT..Server: Apache/2.2.22 (Win64) PHP
/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length: 47..Keep-Alive: tim
eout=5, max=100..Connection: Keep-Alive..Content-Type: text/html......
..<meta http-equiv="refresh" content="300">..

The Application connects to the servers at the folowing location(s):

Map

Strings from Dumps

beckinsale.exe_308:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

... %d%%

... %d%%

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf7.tmp\ExecCmd.dll

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf7.tmp\ExecCmd.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf7.tmp\ExecCmd.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf7.tmp\ExecCmd.dll

"%Program Files%\hydrophobic\scavenges.exe"

"%Program Files%\hydrophobic\scavenges.exe"

.reloc

.reloc

EnumWindows

EnumWindows

ExecCmd.dll

ExecCmd.dll

Kernel32.DLL

Kernel32.DLL

e%uy%u

e%uy%u

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf7.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf7.tmp

nsf7.tmp

nsf7.tmp

rogram Files\hydrophobic\scavenges.exe"

rogram Files\hydrophobic\scavenges.exe"

q scavenges.exe" | %SystemRoot%\System32\find /I "scavenges.exe"

q scavenges.exe" | %SystemRoot%\System32\find /I "scavenges.exe"

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf7.tmp

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsf7.tmp

"%Program Files%\cultivators\beckinsale.exe"

"%Program Files%\cultivators\beckinsale.exe"

%Program Files%\cultivators

%Program Files%\cultivators

beckinsale.exe

beckinsale.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh6.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh6.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

%Program Files%\cultivators\beckinsale.exe

%Program Files%\cultivators\beckinsale.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Nullsoft Install System v2.46

Nullsoft Install System v2.46

ators\beckinsale.exe"

ators\beckinsale.exe"

phobic\scavenges.exe"

phobic\scavenges.exe"